rustsec-2026-0368

{
  "aliases": [
    "GHSA-4v9h-p7m9-rh26"
  ],
  "categories": [
    "privilege-escalation"
  ],
  "crate": "zip",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": ""
  },
  "date": "2026-10-09",
  "deb_packages": [
    {
      "crate_name": "czkawka-cli",
      "deb_name": "czkawka-cli",
      "version": "12.0.2-2"
    },
    {
      "crate_name": "czkawka-gui",
      "deb_name": "czkawka-gui",
      "version": "12.0.2-1"
    },
    {
      "crate_name": "icu4x-datagen",
      "deb_name": "icu4x-datagen",
      "version": "2.2.0-1+b2"
    },
    {
      "crate_name": "ognibuild",
      "deb_name": "ognibuild",
      "version": "0.2.21-1"
    },
    {
      "crate_name": "xleak",
      "deb_name": "xleak",
      "version": "0.2.6+dfsg-1+b1"
    }
  ],
  "description": "In `zip` 9.0.0-pre2, `ZipArchive::extract` creates a symbolic link from an archive entry after validating only the output entry path. The link target bytes are passed directly to the platform symlink API, so a malicious archive can create an entry inside the destination that resolves to an attacker-chosen path outside it. This behavior was verified on macOS and Linux. On either platform, a subsequent application read or write through that extracted entry accesses the external target with the extracting process's permissions.\n\nFor further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4v9h-p7m9-rh26",
  "id": "RUSTSEC-2026-0368",
  "keywords": [
    "privilege-escalation",
    "symlink"
  ],
  "patched_versions": [
    ">=9.0.0"
  ],
  "source": "debian_rustsec",
  "title": "zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory",
  "url": "https://rustsec.debian.net/advisories/RUSTSEC-2026-0368.html"
}